CVE-2026-11482: SQL Injection in SourceCodester Class and Exam Timetabling System 1.0

Technical summary

CVE-2026-11482 is a SQL injection vulnerability affecting SourceCodester Class and Exam Timetabling System 1.0. The flaw exists in /archive5.php where user-controlled input from the 'sy' argument is processed without proper sanitization or parameterization before being used in SQL queries. The vulnerability is classified under CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component) and CWE-89 (SQL Injection). With a CVSS 3.1 score of 7.3 (HIGH), it has a network attack vector, requires no privileges or user interaction, and grants attackers read, write, and delete capabilities on the underlying database.

Business impact

SQL injection vulnerabilities in educational administration systems pose significant operational and data protection risks. Attackers could compromise student records, grades, exam schedules, and institutional data. For organizations relying on this timetabling system, exploitation could disrupt academic schedules, expose personally identifiable information of students and staff, trigger compliance violations (e.g., FERPA, GDPR), and damage institutional reputation. The public availability of exploit code substantially increases the likelihood of opportunistic attacks.

Affected systems

SourceCodester Class and Exam Timetabling System version 1.0 is affected. Organizations running this application should immediately inventory all deployments, particularly those hosting student or staff records. The vulnerability does not appear limited to a specific database backend, as SQL injection generically impacts SQL-based systems.

Exploitability

This vulnerability is highly exploitable. The attack requires no authentication, no user interaction, and can be performed remotely by simply crafting a malicious HTTP request to /archive5.php with a modified 'sy' parameter. Public exploit code availability means threat actors have ready-made tools for deployment. The low attack complexity (AC:L) and lack of prerequisites make this a prime target for both targeted campaigns and opportunistic scanning.

Remediation

Immediate action is required. Organizations should disable or restrict access to the Class and Exam Timetabling System until a vendor patch is applied. Verify with SourceCodester whether a patched version is available; if no patch exists, consider alternative timetabling solutions. As a temporary measure, implement network-level access controls to limit exposure of the application to trusted networks only. Conduct a database audit to detect unauthorized access or data modification post-disclosure.

Patch guidance

Contact SourceCodester directly or monitor their security advisories for a patched version of Class and Exam Timetabling System. Verify patch availability before deploying; if the vendor does not provide a timely update, prioritize migration to an alternative, actively maintained timetabling platform. Test any patch in a non-production environment before rolling out organization-wide.

Detection guidance

Monitor web server logs for requests to /archive5.php containing suspicious characters in the 'sy' parameter (e.g., quotes, dashes, SQL keywords like UNION, SELECT, OR). Deploy a Web Application Firewall (WAF) with SQL injection detection rules to block or flag payloads. Conduct database query logging and review for anomalous or unauthorized queries. Alert on any access to the application from external networks if it should only be accessed internally.

Why prioritize this

This vulnerability merits urgent prioritization due to the combination of high CVSS score (7.3), public exploit availability, remote network exploitability without authentication, and the sensitive nature of data typically stored in educational administration systems. The absence of KEV designation does not diminish the risk; public exploits and the straightforward attack mechanism mean active exploitation is likely.

Risk score, explained

The CVSS 3.1 score of 7.3 reflects the vulnerability's network attack vector (AV:N), low attack complexity (AC:L), lack of required privileges (PR:N), and no user interaction requirement (UI:N). The score indicates low confidentiality, integrity, and availability impact (C:L/I:L/A:L) because an attacker gains database access but the scope is limited to that single application's data store. The HIGH severity rating is appropriate given the real-world risk of data theft and manipulation in an educational context.

Frequently asked questions